The resource owner's _username.
The resource owner's _password.
An array of strings representing the scope of the authorization request. (may be null)
OAuthException if user authentication fails or the client could not be granted access on behalf of the resource owner for any scope requested.
Start a session on behalf of the resource owner, using _username and _password for authentication.
This authentication flow SHOULD be used only as a last resort, as it requires exposal of the plain _username and _password to the client.